CVE-2026-6848

A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-6848	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2460119	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un defecto en Red Hat Quay. Cuando Red Hat Quay solicita la reverificación de contraseña para operaciones sensibles, como la generación de tokens o la creación de cuentas de robot, la solicitud de re-autenticación puede ser omitida. Esto permite a un usuario con una sesión caducada, o a un atacante con acceso a una sesión de navegador autenticada inactiva, realizar acciones privilegiadas sin proporcionar credenciales válidas. La vulnerabilidad permite la ejecución no autorizada de operaciones sensibles a pesar de que la interfaz de usuario muestra un error por credenciales inválidas.

Information

Published : 2026-04-22 10:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-6848

Mitre link : CVE-2026-6848

CVE.ORG link : CVE-2026-6848

JSON object : View

Products Affected

redhat

quay

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-6848", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6848", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T12:55:17.431562Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:quay:3"], "vendor": "Red Hat", "product": "Red Hat Quay 3", "packageName": "quay/quay-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quay:3"], "vendor": "Red Hat", "product": "Red Hat Quay 3", "packageName": "quay/quay-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-22T10:16:52.347", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-6848", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460119", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle authenticated browser session, to perform privileged actions without providing valid credentials. The vulnerability enables unauthorized execution of sensitive operations despite the user interface displaying an error for invalid credentials."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en Red Hat Quay. Cuando Red Hat Quay solicita la reverificaci\u00f3n de contrase\u00f1a para operaciones sensibles, como la generaci\u00f3n de tokens o la creaci\u00f3n de cuentas de robot, la solicitud de re-autenticaci\u00f3n puede ser omitida. Esto permite a un usuario con una sesi\u00f3n caducada, o a un atacante con acceso a una sesi\u00f3n de navegador autenticada inactiva, realizar acciones privilegiadas sin proporcionar credenciales v\u00e1lidas. La vulnerabilidad permite la ejecuci\u00f3n no autorizada de operaciones sensibles a pesar de que la interfaz de usuario muestra un error por credenciales inv\u00e1lidas."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1987BDA-0113-4603-B9BE-76647EB043F2"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}